Kiteworks patches flaw allowing remote takeover of email gateway

Image: Primary

Published Thursday, October 1, 2026 · 11:12 AM EDT

Kiteworks released updates addressing 126 vulnerabilities, including a maximum-severity flaw that can let unauthenticated remote attackers take over its Email Protection Gateway. Tracked as CVE-2026-54154, the flaw affects every gateway release before 9.4.1 and is patched in 9.4.1 or later. Attackers can chain path traversal, code injection and missing authentication to execute code without user interaction, then exploit additional local weaknesses to gain root control. The updates also fix 11 critical vulnerabilities in Kiteworks' Core and gateway components. Shadowserver tracks nearly 400 internet-exposed Kiteworks instances, but does not identify how many are patched or are honeypots.

Sources

BleepingComputer

Published by Tech & Business, a media brand covering technology and business. This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.

Back to Newswire

Keep reading

Full wire

Capital

Edelbyte emerges from stealth with $70 million in funding

Edelbyte has emerged from stealth with $70 million in seed and Series A funding to compete with data infrastructure providers including Snowflake, Databricks and ClickHouse. Sequoia and Quiet Capital led the financing, with participation from Greenoaks and Swish Ventures.

Security

TSMC confirms employee data leak linked to cloud provider

TSMC confirmed that personal information belonging to current and former employees was published online without authorization.

Capital

Nidus raises $30M across pre-seed and seed rounds

Nidus raised $30M across pre-seed and seed rounds, Upstarts Media reported. Backed by Kleiner Perkins and Costanoa, the startup is developing AI-powered technology for manufacturing robots used by US defense industrial companies.

Policy

Judge allows DRAM antitrust case against three chipmakers to proceed

Judge Noël Wise denied Micron, Samsung and SK hynix's motion to dismiss a proposed class action alleging that they coordinated restrictions on DRAM memory supply.

Capital

TSMC plans $500 million fund for chip startups and suppliers

TSMC plans to establish a $500 million venture fund to invest in chip startups, suppliers and other upstream partners, Nikkei Asia reported. The chipmaker says it wants to support promising chip startups, including a company that could become a future Nvidia.

Infrastructure

Vulcan launch failure destroys 40 Amazon Leo satellites

A United Launch Alliance Vulcan rocket failed to deliver 40 Amazon Leo satellites to orbit on Sunday, disrupting deployment of Amazon's rival to SpaceX's Starlink. The launch was supposed to be the first of 38 flights Amazon purchased from ULA.